Tag: security

PHP 8.4.25 and 8.5.10 RC add stack limit checks to array_walk_recursive, compact, array comparison, and DOM normalize. Segfaults become catchable Errors.

Livewire 4.3 added a declarative #[Authorize] attribute for actions, closing a common gap. How it works, the fixes since, and where it still falls short.

PHP 8.6 flips three insecure session defaults, use_strict_mode, cookie_httponly, and cookie_samesite, closing gaps OWASP has flagged for years.

NativePHP Desktop 2.2 adds Nightwatch integration and window polish, then 2.2.1 patches a real issue where the Electron API server could bind past localhost.

Symfony 8.2 adds a $version argument to UriSigner so a signed URL invalidates itself after one use. A clean native fix for password reset and login links.

Composer 2.10 adds native malware blocking and a unified config.policy framework for PHP supply chain security. Here is how it works and how to tune it.

The PHP Foundation's new Ecosystem Security Team scanned 300+ Composer packages in its first month. Here is what shipped and how to get involved.

The PHP Foundation's 2025 impact report reveals 2,929 commits, a new Ecosystem Security Team funded by Alpha-Omega, and bold goals for 2026.

Composer 2.9 and 2.10 bring automatic security blocking, a new repo CLI command, and malware filtering. Here's what changed and how to use it.

PHP 8.5's built-in URI extension replaces the broken parse_url() with RFC 3986 and WHATWG-compliant classes for immutable, safe URL handling.

Symfony 7.3 ships two powerful new components — ObjectMapper and JsonPath — plus console upgrades and security wins worth knowing about.